Guide How to get started with learning ViewMatrix

Hexui Undetected CSGO Cheats Sinkicheat PUBG Cheat

Rake

Cesspool Admin
Administrator
Jan 21, 2014
11,574
78,998
2,317
Game Name
N/A
Anticheat
N/A
Tutorial Link:
N/A
How long you been coding/hacking?
5 Years
Coding Language
Usually C++
What is a view matrix?
Matrices are used to define the location of things inside a coordinate system as well as how these things are projected onto your screen. There are actually several matrices used in 3D game programming they are:

  • Model Matrix
  • World Matrix
  • View Matrix
  • Projection Matrix

These are often all multiplied together and stored as another matrix named the Model-View-Projection Matrix. By using this matrix, you can do one transformation to move 3D coordinate into screen space.

A view matrix is 4 Vector3 structures that represents the camera position, it's viewport and frustrum. 3 of these vectors are the rotation matrix, representing the Right, Up & Forward (Look) axes. The other vector encodes the position. It can also be looked at as an array of 16 float values.

3D Game Programming uses view matrices to "transform" vertices of objects. The view matrix is used in our WorldToScreen() function to convert 3D world positions of entities to 2D screen space.

How to find the view matrix?

Why do you need the view matrix?
In order to make an ESP you need to know the 2D position of entities on the screen. To do this, you use a WorldToScreen function, but one of the required arguments is the view matrix. By using the transformation pipeline you can convert 3D coordinates to 2D coordinates.

This is done by using matrix math, most importantly Matrix Multiplication. Converting a 3D coordinate into screen space is referred to as a viewport transformation, and it uses the transformation pipeline.

1569857994101.png

Image credits: The Model Matrix

In order to write a WorldToScreen function you need to understand the transformation pipeline, you can learn more about it from these resources:

The absolute best resource to learning about viewport transformations
OpenGL Transformation

You can also download 2 cool programs to help you visualize it at the top of his page you will find zip downloads:

1569858365780.png

WorldToScreen functions for Direct3D, OpenGL, C++, C# and more
Source Code - World2Screen - DIrect3D and OpenGL WorldToScreen Functions

Best GH Resources:

Additional resources

 
Last edited:

Drew

Newbie
Full Member
Aug 21, 2013
9
172
0
I want to make a hack for dayz standalone where there is a line drawn from bottom of the screen to the object (loot)
So far i have got the shader constants for the object by dissambling the vertexshader, here is the output

Inside my DrawIndexPrimitive Hook
if(primCount == 474) //gprimCount)
{
//doDisassembleShader(pDevice,"ShovelShaderLog.txt") ;
WorldToScreen(pDevice);
pDevice->SetRenderState(D3DRS_FILLMODE,D3DFILL_SOLID);
pDevice->SetRenderState(D3DRS_ZENABLE, true);
pDevice->SetPixelShader(RedShader);
}

// Registers:
//
// Name Reg Size
// ----------------------------------------------------- ----- ----
// FogModeA b0 1
// FogModeB b1 1
// ShadowReceiverFlag b4 1
// EnableAlignNormal b6 1
// ShadowReceiverSSSM b7 1
// VSC_PointLoopCount i0 1
// VSC_SpotLoopCount i1 1
// VSC_ViewMatrix c0 3
// VSC_ProjMatrix c3 4
// VSC_CameraPosition c7 1
// VSC_TexTransform c8 12
// VSC_InstanceColor c25 1
// VSC_SpecularPower_Alpha_FogEnd_RCPFogEndMinusFogSt art c31 1
// VSC_Free_ExpFog_AFogEnd_RCPAFogEndMinusAFogStart c34 1
// VSC_ShadowmapMatrix c35 3
// VSC_InstanceLandShadowIntensity c38 1
// VSC_LWSMatrix c43 3
// LPSData c214 20
//

So this is my function

void WorldToScreen(IDirect3DDevice9* Device)
{
D3DVIEWPORT9 Viewport;
Device->GetViewport(&Viewport);

Device->GetVertexShaderConstantF(0,ViewMatrix,3);//VSC_ViewMatrix
Device->GetVertexShaderConstantF(3,Projecti********,4);//VSC_ProjMatrix


D3DXMatrixIdentity(&WorldToLocal);


D3DXVec3Project(&Vector2D,
&Vector3D,
&Viewport,
&Projecti********,
&ViewMatrix,
&WorldToLocal);
if(Vector2D.z < 1.0f)
{
X = static_cast<int>(Vector2D.x);
Y = static_cast<int>(Vector2D.y);
}
}

But its not working at all,looking for help to solve this so X,Y point to the correct location on screen

The Screenshot is the effect i want
 

Attachments

dzine

Newbie
May 3, 2016
1
32
0
hello guys,
i know there are already many threads about the viewmatrix but still i want to know how the get the correct address.

i tried getting the address with cheatengine and the ingame function "setang".
i searched the whole forum and saw that this seems to work for people. but however not for me though.

here are the addresses i always get as a result from my search:



im currently using 0x597980 as the viewmatrix which doesnt seem to work.
i tried the rest of these but also without success,

thanks for any answer!
 

Rake

Cesspool Admin
Administrator
Jan 21, 2014
11,574
78,998
2,317
hello guys,
i know there are already many threads about the viewmatrix but still i want to know how the get the correct address.

i tried getting the address with cheatengine and the ingame function "setang".
i searched the whole forum and saw that this seems to work for people. but however not for me though.

here are the addresses i always get as a result from my search:



im currently using 0x597980 as the viewmatrix which doesnt seem to work.
i tried the rest of these but also without success,

thanks for any answer!
hmm I don't know if you saw this
'

this one is old for css but maybe can help you:
Tutorial - WorldToScreenMatrix Source Engine

https://guidedhacking.com/threads/how-to-get-started-with-viewmatrix.13663/
https://guidedhacking.com/threads/world2screen-direct3d-and-opengl-worldtoscreen-functions.8044/
 
Last edited:

OfficialHydrux

Newbie
Full Member
Oct 19, 2015
25
148
0
Have you tried this

First step :


Set ViewAngle.x to 89.0
Set ViewAngle.y to 49.0

Search for 0.75 !



Second step :


Set ViewAngle.x to 0.0
Set ViewAngle.y to 5.0

Search for 0.08 !



[CSGO] The second client.dll entry in the list should be your vMatrix flicker free offset
[CSS] The last engine.dll entry in the list should be your vMatrix flicker free offset
 
Last edited:

Niiw

Newbie
Full Member
Oct 5, 2014
5
898
0
Have you tried this

For those who struggle follow these steps (I promise you will find the viewMatrix very easily)

Open CheatEngine, and attach to "hl2.exe" process.

Select "Float" and "Unknown initial value" and do the first scan


Now open console and as OfficialHydrux mentionned, we have to set our view angles.

To do this, paste this in your console : sv_cheats 1 (this will enable cheat mode in the game)

Now, still in the console, type : Setang 89 49 0 (<--we set the angles manually, you will see that the player will move)




Now go back in CheatEngine and make sure your settings are like mine :



Make sure you put 0.75 and press Next scan !

(I passed from 75.000.000 values to 33.000 after this ^^)

Now go back in counter strike and in the console type: Setang 0 5 0

Go back in cheat engine, and make sure you select "Rounded (extrem)"



and Press Next Scan

Now you will have not alot of adresses.. :) I have 38 left


Let's try this one more time... Go back to CSS, in console : Setang 89 49 0

Go back in cheat engine : put 0.75 and Next scan

Gp back in CSS : Setang 0 5 0

Go back in Cheat Engine : put 0.08 and Next Scan



Okay so now we have 33 addresses. In counter strike source, you have alot of static adresses (green ones)
you can be 99,99% sure that the viewMatrix is in the green adresses that are left.

So select all the black ones and right click & "Remove"




So now I have 15 green addrresses left (they are pointers :))

What's left to do?

Test each one of them one by one until you find the good one.

15 is not alot and is very fast to test.

I followed Fleep's ESP tutorial.

And So to test them, you select all of them and press the red arrow so that they go at the bottom:



Now we have to check each adress. The viewMatrix is stored in engine.dll module.
So double-click on each adress one-by-one and look if it starts with "engine.dll"+xxxx

IF YES, leave it
IF NO, delete it

For example :

this we leave:


this or this we delete




No we have very small amount of addresses left, this is good :)

Personnaly, I had 8 left after all this.

Nearly finished. So now we test them !

Take each address one by one, double-click and copy whats after "engine.dll"+xxx

And past them in your code & run your ESP hack to see if it's the good one.



When you will have the right address, the ESP will work great ! ;)

PS: If you are not sure about your antiFlicker address, comment theses lines before testing:
 
Last edited by a moderator:

rogerxiii

Newbie
Mar 28, 2014
4
152
0
Hi all,

I'm making an external ESP hack, based on Fleep's code, for a lot of games.
The only offset I'm having trouble with finding is the vMatrix.
Anyone have any tips on finding this address through Cheat Engine?
Or do I need to use a debugger like olly?

The game specifically is Call of Duty: Black Ops 2.

Thanks.
 

rogerxiii

Newbie
Mar 28, 2014
4
152
0
I have no experience with direct3d programming, but this is what I did. I tried to set a breakpoint in olly for the function call GetTransform, but the game doesn't execute my breakpoint. What exactly am I supposed to do with that then?
 

rogerxiii

Newbie
Mar 28, 2014
4
152
0
Are you trying to do a ReadProcessMemory only ESP? If so I'd try to make it FOV based. If you're working internally create a D3D hook first (EndScene or Present, there are good public hooks) then try finding the ViewMatrix (whatever way via Memory or GetTransform).
Yes, only reading memory since I can't be arsed getting it to work with the anti-cheats. How do you propose I make it FOV based? Just beginning with game hacking.
 

jenscrevits

Newbie
May 8, 2015
1
104
0
Warning: No Requesting Help Without Effort
i cant seem to find the scum view matrix, can someone find it for me pls?
 

mambda

headass
Escobar Tier VIP
Trump Tier Donator
Jun 25, 2014
2,279
37,938
268
not a place where people do your work for you. its a place where people help you arrive to the answer yourself. If you want to be spoon fed its a simple google search away
 
Jun 12, 2019
1
1,008
0
Hello, I successfully hooked openGL SwapBuffers and now I want to draw a line from the top left corner of the window to Entity. But all the address for viewmatrix I have found are wrong.

I have used Rake W2S function for openGL, my implementation :

C++:
bool WorldToScreen(Vector3 pos, Vector3& screen, float matrix[16], int windowWidth, int windowHeight) {
    //Matrix-vector Product, multiplying world(eye) coordinates by projection matrix = clipCoords
    Vector4 clipCoords;
    clipCoords.x = pos.x * matrix[0] + pos.y * matrix[4] + pos.z * matrix[8] + matrix[12];
    clipCoords.y = pos.x * matrix[1] + pos.y * matrix[5] + pos.z * matrix[9] + matrix[13];
    clipCoords.z = pos.x * matrix[2] + pos.y * matrix[6] + pos.z * matrix[10] + matrix[14];
    clipCoords.w = pos.x * matrix[3] + pos.y * matrix[7] + pos.z * matrix[11] + matrix[15];

    if (clipCoords.w < 0.1f)
        return false;

    //perspective division, dividing by clip.W = Normalized Device Coordinates
    Vector3 NDC;
    NDC.x = clipCoords.x / clipCoords.w;
    NDC.y = clipCoords.y / clipCoords.w;
    NDC.z = clipCoords.z / clipCoords.w;

    //Transform to window coordinates
    screen.x = (windowWidth / 2 * NDC.x) + (NDC.x + windowWidth / 2);
    screen.y = -(windowHeight / 2 * NDC.y) + (NDC.y + windowHeight / 2);
    return true;
}

void hwglSwapBuffers(_In_ HDC hDc) {
    EntityManager::UpdateEntity();
    Aimbot::Init();

    for (auto& i : EntityManager::m_EnemyPlayers) {
        Vector3 pos;
        WorldToScreen(i->position, pos, Viewmatrix::GetInstance()->matrix, Window::GetInstance()->Width, Window::GetInstance()->Height);

        std::cout << pos.x << " " << pos.y << " " << pos.z << std::endl;

        DrawLine(0, 0, (int)pos.x, (int)pos.y);
    }
}
Addresses I found :
sauerbraten.exe+297A08
sauerbraten.exe+297B1C
sauerbraten.exe+297E48
sauerbraten.exe+2996C8
 

SystemX32

Meme Tier VIP
Dank Tier Donator
Jun 2, 2015
249
7,118
43
For my Cube 2: Sauerbraten cheat, I used sauerbraten.exe+0x13E71C as the view matrix. I also used the exact same W2S function as you. I found this address by following this tutorial:
 
  • Like
Reactions: Rake

kevin5881413

Newbie
Full Member
Jul 13, 2015
35
713
2
If we find that the matrix in the game is a view matrix, why don't we need a projection matrix?
Which kind of matrix do we find in the game?? Is the View Matrix or Model-View-Projection Matrix ??

I'm confused...:oops:
 

mambda

headass
Escobar Tier VIP
Trump Tier Donator
Jun 25, 2014
2,279
37,938
268
If we find that the matrix in the game is a view matrix, why don't we need a projection matrix?
Which kind of matrix do we find in the game?? Is the View Matrix or Model-View-Projection Matrix ??

I'm confused...:oops:
to convert from world coordinates you need the (model)view-projection matrix. Its been colloquially described as the "view matrix" online, though thats obv not accurate
 
  • Like
Reactions: kevin5881413

Rake

Cesspool Admin
Administrator
Jan 21, 2014
11,574
78,998
2,317
If we find that the matrix in the game is a view matrix, why don't we need a projection matrix?
Which kind of matrix do we find in the game?? Is the View Matrix or Model-View-Projection Matrix ??

I'm confused...:oops:
I explain this in the videos, maybe you should watch them?
 

Rake

Cesspool Admin
Administrator
Jan 21, 2014
11,574
78,998
2,317
I got a new idea on finding view matrices on any game, it's universal

Here is a matrix copy function from L4D2 Source, it takes the matrix in the address held by ECX and copies it into the EAX address:

1574818507777.png


This is basically the same in every game. Forget about the beginning and end of the function, just focus on the pushing on popping of float values on the FPU stack, skip the first 2 instructions also just in case.

You get:

D9 41 04 D9 58 04 D9 41 08 D9 58 08 D9 41 0C D9 58 0C D9 41 10 D9 58 10 D9 41 14 D9 58 14 D9 41 18 D9 58 18 D9 41 1C D9 58 1C D9 41 20 D9 58 20 D9 41 24 D9 58 24 D9 41 28 D9 58 28 D9 41 2C D9 58 2C D9 41 30 D9 58 30 D9 41 34 D9 58 34 D9 41 38 D9 58 38 D9 41 3C D9 58 3C

Now, what if the game uses different registers? Make your pattern work with any registers:

D9 ?? 04 D9 ?? 04 D9 ?? 08 D9 ?? 08 D9 ?? 0C D9 ?? 0C D9 ?? 10 D9 ?? 10 D9 ?? 14 D9 ?? 14 D9 ?? 18 D9 ?? 18 D9 ?? 1C D9 ?? 1C D9 ?? 20 D9 ?? 20 D9 ?? 24 D9 ?? 24 D9 ?? 28 D9 ?? 28 D9 ?? 2C D9 ?? 2C D9 ?? 30 D9 ?? 30 D9 ?? 34 D9 ?? 34 D9 ?? 38 D9 ?? 38 D9 ?? 3C D9 ?? 3C

This pattern should match any game that makes copies of matrices (well any array of floating points which is 0x40 in size)

You can then hook all these functions and hopefully it accesses the proper view matrix.

Here is what it looks like for CSGO:

1574819270892.png


Here is the pattern for CSGO:
8B ?? 04 89 ?? 04 8B ?? 08 89 ?? 08 8B ?? 0C 89 ?? 0C 8B ?? 10 89 ?? 10 8B ?? 14 89 ?? 14 8B ?? 18 89 ?? 18 8B ?? 1C 89 ?? 1C 8B ?? 20 89 ?? 20 8B ?? 24 89 ?? 24 8B ?? 28 89 ?? 28 8B ?? 2C 89 ?? 2C 8B ?? 30 89 ?? 30 8B ?? 34 89 ?? 34 8B ?? 38 89 ?? 38 8B ?? 3C 89 ?? 3C

Gonna test this idea on a couple games, it already worked on L4D2, thank you @Icew0lf for this idea
 
Last edited:
Attention! Before you post:

Read the How to Ask Questions Guide
99% of questions are answered in the Beginner's Guide, do it before asking a question.

No Hack Requests. Post in the correct section.  Search the forum first. Read the rules.

How to make a good post:

  • Fill out the form correctly
  • Tell us the game name & coding language
  • Post everything we need to know to help you
  • Ask specific questions, be descriptive
  • Post errors, line numbers & screenshots
  • Post code snippets using code tags
  • If it's a large project, zip it up and attach it

If you do not comply, your post may be deleted.  We want to help, please make a good post and we will do our best to help you.

Community Mods League of Legends Accounts